A. AMENDMENTS TO SPECIFICATION 

Please amend the application as indicated hereinafter: 
Section 0002: 

The data networks that are deployed by service providers or large enterprises often 
comprise hundreds or thousands of network devices. A network device may comprise of on e 
one or more network elements, which are entities like modules, ports, slots etc. The network 
devices and their corresponding network elements may be managed by one or more network 
management systems, such as an operational support system (OSS), which are implemented 
using computer application programs that can communicate with the network devices. OSS 
applications are either obtained from commercially available sources or developed internally 
by telecommunications service providers. 

Section 0016: 

The foregoing needs, and other needs and objects that will become apparent for the 
from the following description, are achieved in the present invention, which comprises, in 
one aspect, a "generic" method of generating a label for use in correlating alarms emitted by 
network elements or system elements in a telecommunications network. The disclosed 
method is independent of the protocol used by a particular device vendor. An alarm message 
generated by a network element or system element of the telecommunications network is 
received. A context value in the alarm message is identified. A table that associates context 
values to internal correlation key value formulas is maintained. A unique external correlation 
key value or label is generated for the internal correlation key value. The alarm message and 
correlation key value are sent to an external system for use in correlating alarms. 
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Section 0018: 

In another feature, the external system is an OSS syst e m of a telecommunications 
service provider. The table may be stored at a gateway or proxy that is logically located in 
the telecommunication network between the network element or system element and an OSS 
syst e m of a telecommunications service provider. 

Section 0023: 

In one specific approach, wherein each formula in the table specifies, for an 
associated context value, one or more ordinal positions of a plurality of fields fi e lds in the 
alarm message, or a pattern to match, and one or more references to external database 
indexes or to programmatic procedures that are stored in an external database system, and 
wherein a concatenation of the fields and a result value from execution of the programmatic 
procedures yields the internal correlation key value. As another feature, the table is stored at 
a gateway that is logically located in the telecommunication network between the network 
element or system element and an OSS system-of a telecommunications service provider; 
each formula in the table specifies, for an associated context value, one or more ordinal 
positions of fields in the alarm message and one or more references to objects in an external 
database system that is accessible to the gateway; and a concatenation of the fields and 
objects yields the internal correlation key value. 
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Section 0024: 

Sending the alarm message and external correlation key value or label may involve 
sending an SNMP message to an OSS system that includes a complete SNMP object carrying 
the alarm message and the correlation key value. In another feature, an XML file is sent to an 
OSS syst e m that includes the alarm message and the external correlation key value or label 
identified by unique XML tags. 

Section 0027: 

In this arrangement, benefits accrue in that the parsing module to extract correlation 
keys may be written once and thereby reduce the cost of the OSS s yst e m . The potential for 
erroneous interpretation of alarms is reduced because the correlation keys and proxy servers 
may be tested and supported by the same party that creates, sells, services or maintains the 
corresponding network elements and system elements. The processing efficiency of the OSS 
in parsing unique error messages is greatly enhanced and simplified using relatively simple 
string comparison operations. 

Section 0040: 

In one embodiment, in a method for generating internal correlation key values for use 
in correlating alarms generated by network elements in a telecommunications network, an 
alarm message generated by a network element or system element of the telecommunications 
network is received. A context value in the alarm message is identified using a lookup table 
having an entry for each supported alarm. A table that associates context values to correlation 
key value formulas is maintained. A formula specifying how to generate the correlation key 
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value is retrieved from the table. A unique external correlation key value is created based on 
the formula. The alarm message and external correlation key value are sent to an external 
system, such as an OSS, for use in correlating alarms. The alarm message may be an SNMP 
message and the context value may be an SNMP context string. The table may be stored at a 
gateway that is logically located in the telecommunication network between the network 
element or system element and an OSS syst e m of a telecommunications service provider. 
Each formula in the table may specify, for an associated context value, one or more ordinal 
positions of fields in the alarm message, or a pattern from which the fields are extracted, a 
concatenation of which yields the correlation key value. A formula may reference objects or 
programmatic procedures in an external database system. Because the internal keys may be 
large, the external keys are generated to uniquely represent the internal keys. 

Section 0048: 

FIG. IB is a block diagram of an example network context in which an embodiment 
may be used. A managed n e twork 102 network 101 comprises at least one network element 
120 that maintains a log file 103. Network element 120 may be one or more routers, 
switches, or other network devices. Network element 120 is communicatively coupled to 
other devices in network 102 and to a gateway 140 having a fault correlation proxy 130. The 
gateway 140 is further communicatively coupled, directly or indirectly through one or more 
intervening networks, to network management station 104. Network management station 104 
executes an OSS 108 that includes a comparison module 150. Comparison module 150 
carries out a string comparison, numeric comparison, bitwise comparison, or other 
comparison as appropriate to the data type of the keys and labels. 
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Section 0049: 

For purposes of illustrating a simple example, FIG. IB shows one network device 
120. In a practical system, however, managed n e twork 102 network 101 may include any 
number of network devices, and may comprise one or more local area networks, wide area 
networks, metropolitan area networks, campus networks, or inter-networks. 

Section 0054: 

OSS 108 receives the alarm message. Comparison module 150 of OSS 108 examines 
the correlation key value in the alarm message and determines whether it matches a 
previously received alarm message. If not, OSS 108 d e t e rmin e s if the alarm m e ssag e is 
relatively n e w. Thus i lf no match occurs, then OSS 108 processes the received alarm. Such 
processing may include reporting the alarm to an end user through a graphical user interface, 
logging the received alarm in a log file of OSS 108, executing a pre-defined program to carry 
out specified steps, etc. 

Section 0058: 

Parsing module 132 may comprise one or more parsing processes that carri e d carry 
out required parsing using data from table 134. Each of the parsing processes is responsible 
for parsing a particular kind of alarm or event, or alarms or events from a particular kind of 
device. When an alarm is received, fault correlation proxy 130 selects one of the parsing 
processes based on information in the alarm. This arrangement enables fault correlation 
proxy 130 to process alarms having any format. 
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Section 0064: 

In another embodiment, a value for a formula may be obtained by a database query or 
other query to an external system. In this embodiment, the formula in the intelligence table 
comprises a reference to a database object, or to an external function or process that provides 
a value for the correlation key. For example, an entry in the intelligence table may comprise 
the context string "ssngSyslogLinkStateChanged" and the formula "<1> + <2> + <13> + 
<cust_ID>." The values "<1> " "<2>," and "<13>" reference the first, second, and thirteenth 
ordinal positions of fields in the associated context string. The value <cust_ID> is the name 
of an object in a database system that is accessible to gateway 140. Thus, the formula 
indicates that the correlation key is generated by a string concatenation of the context string, 
the values "RouterA," "10.1.1.1," "1/20," "2/1/30" and the value of a database variable 
named <cust_ID>, or a value returned by a database stored procedure named <cust_ID>. 
Alternatively, the value <custJD> references an external function or process that generates a 
customer identifier, such as a function of an API of the OSS, a function of a dynamic linked 
library, etc. This approach enables gateway 140 to introduce a customer-specific or otherwise 
unique element into the correlation key value. 

In Section 0074: 

Network element layer 208 represents the logical position of network devices in a 
network. Network element layer 208 may comprise, for example, one or more access devices 
acting as media gateways 120C; one or more edge devices acting as media gateways 120D; 
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one or more core devices 226, which do not act as MGs; and one or more media gateway 
controllers 112C. 

In the Abstract: 

A method for generating compressed correlation key values for use in correlating 
alarms generated by network elements in a telecommunications network is disclosed. An 
alarm message generated by a network element is received. A context value in the alarm 
message is identified. A table that associates context values to correlation key value formulas 
is maintained. A formula specifying how to generate the correlation key value is retrieved 
from the table. Each formula may specify, for an associated context value, one or more 
ordinal positions of fields in the alarm message, a concatenation of which yields the 
correlation key value. The correlation key value is created based on the formula. A unique 
ordinal number is generated to represent the correlation key value, which acts as a context 
key. Th e ordinal numb e r and th e cont e xt k e y pair ar e stor e d in e xt e rnal p e rsist e nt storag e for 
lat e r r e tri e val in cas e of r e start. The alarm message and correlation key value are sent to an 
external system for use in correlating alarms. Th e alarm messag e may b e an SNMP m e ssag e 
and th e context value may b e an SNMP cont e xt string. Th e tabl e may b e stor e d at a gateway 
in th e t e l e communication network b e tw ee n th e n e twork el e m e nt and an OSS syst e m. Each 
formula may sp e cify, for an associat e d cont e xt valu e , on e or more ordinal positions of fi e lds 
in th e alarm m e ssag e , a concat e nation of which yi e lds th e corr e lation k e y valu e . A formula 
also may r e f e r e nc e obj e cts or programmatic proc e dur e s in an e xt e rnal databas e syst e m. Us e 
of an int e rnal corr e lation k e y and e xt e rnal corr e lation key in this mann e r gr e atly r e duc e s th e 
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ov e rh e ad involv e d in adding corr e lation k e ys to th e original m e ssag e ; for e xampl e , a 32 bit 
num e ric valu e can s e rv e as a corr e lation key for a 100 character alarm m e ssag e . 
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